From 80d030f51a9323b7ab774641ffdb4d2752e3753d Mon Sep 17 00:00:00 2001 From: Jakub Vrana Date: Sat, 13 Jan 2018 22:17:00 +0100 Subject: [PATCH] Disallow scripts without nonce --- adminer/include/adminer.inc.php | 4 ++-- adminer/include/design.inc.php | 15 +++++++++++++-- adminer/include/functions.inc.php | 13 ++++++++++--- adminer/include/version.inc.php | 2 +- adminer/schema.inc.php | 2 +- changes.txt | 3 ++- plugins/login-sqlite.php | 2 +- plugins/tables-filter.php | 2 +- plugins/tinymce.php | 2 +- 9 files changed, 32 insertions(+), 13 deletions(-) diff --git a/adminer/include/adminer.inc.php b/adminer/include/adminer.inc.php index aed9e0e3..736889eb 100644 --- a/adminer/include/adminer.inc.php +++ b/adminer/include/adminer.inc.php @@ -420,7 +420,7 @@ class Adminer { echo "
" . lang('Action') . "
"; echo ""; echo " "; - echo "$trailing"; + return "$source$trailing"; } /** Return \n"; + return "\n"; +} + +/** Get a nonce="" attribute with CSP nonce +* @return string +*/ +function nonce() { + return ' nonce="' . get_nonce() . '"'; } /** Escape for HTML @@ -1242,7 +1249,7 @@ function slow_query($query) { if (support("kill") && is_object($connection2 = connect()) && ($db == "" || $connection2->select_db($db))) { $kill = $connection2->result(connection_id()); // MySQL and MySQLi can use thread_id but it's not in PDO_MySQL ?> -